"file wuauclt.exe is infected" message, XXX pop-ups, and I can't run help software

I have a computer that is infected and the virus/whatever it is blocks all of my help programs from running so I cannot post any logs. I notice you require people to run the list of help software and post logs, but I have tried to do that and can't...I hope you can help me anyway. All of the programs just shut down immediately after opening.

I get a pop-up that says, "The file wusuclt.exe is infected. Do you want to activate your antivirus software now?" every 10 seconds or so, and in addition when I try to open or install CCleaner, SuperAntiSpyware, HijackThis, or MalwareBytes a message pops up to say that those program files are infected. I also get pop-ups on the bottom right of the screen saying that my computer is infected and do I want to block such and such. Additionally, IE will open up by itself every so often with porn ads on it.

That computer is a Windows XP.

Thank you for your help. Please let me know if there is anything else you need to know.

Hello, cyndyinohio
Welcome to the Help2Go Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

Please take note of some guidelines for this fix:

Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.

If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.

Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.

Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.

Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

I set my system to show all files and saved OTL to my desktop. When I double click on the icon, however, I get the same result as with the other programs...a message pops up on the bottom right and says that the application cannot be executed because the file otl.exe is infected. If the OTL screen comes up at all (it usually doesn't) it is only for a split second before it disappears.

I started my computer today and saw that the pop-ups did not start right away, so I thought I'd try to open OTL to see if it could open before the pop-ups started and it did! So, I was able to paste in the text and do a quick scan. I will post the results...may have to put the Extras.txt in another reply since they are long. I will attempt to download GMER and follow those steps another day since it is so late already. I will post again when I am able to do that.

Error - 7/2/2010 11:56:08 PM | Computer Name = SETH | Source = MsiInstaller | ID = 11719
Description = Product: Microsoft Office XP Standard for Students and Teachers --
Error 1719. The Windows Installer Service could not be accessed. This can occur
if you are running Windows in safe mode, or if the Windows Installer is not correctly
installed. Contact your support personnel for assistance.

[ System Events ]
Error - 6/27/2010 10:38:47 PM | Computer Name = SETH | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{692DFE4B-A71C-4117-9DA8-9B0DFA0E910B}
because another computer on the network has the same name. The server could not
start.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.